A missing 75 cents led Cliff Stoll to a ring of German hackers who were selling their access to the KGB. Wired calls the case the first known instance of state-sponsored hacking.
The BBC notes that Stoll was an astronomer, not a spy. He held a PhD in planetary astronomy. Lawrence Berkeley National Laboratory had moved him, not wholly by choice, into its computing department.
Why 75 cents mattered
The lab rented time on its computers to remote users and billed them by the minute. In 1986 Stoll’s boss asked him to explain a 75-cent gap in those accounts. Stoll, then 36, found that someone was logging in without paying.
He spent about a year following the trail across the lab’s network and the young internet. The BBC reports that he watched the unknown user hunt for military data.
How an astronomer tracked a spy
Stoll slept under his desk at the lab. He set his pager to wake him whenever the hacker logged in. Wired notes that his fans in the security trade credit him with methods that later became standard practice.
The trail led beyond one lab. Stoll uncovered a wide pattern of break-ins at military and government agencies. A group of young hackers in Germany was behind them. They had sold what they found to the KGB, the Soviet intelligence service. Stoll brought in the US intelligence community.
What the book did next
Stoll told the story in The Cuckoo’s Egg, published in late 1989. By its 30th anniversary it had sold more than a million copies. For many network defenders it became the founding tale of the lone hacker hunter.
The BBC places the case at the start of a longer line of attacks on US systems linked to Moscow. It argues that Stoll’s find was the first sign that the US would be a rich target for foreign hackers.
Stoll has not worked in security for decades. Royalties from the book paid off his mortgage. He now sells glass klein bottles, shapes with only one side. He told Wired that he never expected security to grow into a multibillion-dollar industry.
